In May 2022, a Virginia jury awarded Appian $2.036 billion in its trade secrets case against Pegasystems – at the time, one of the largest such verdicts in US history. Appian alleged that Pegasystems had paid a software developer, who worked for a government contractor and had access to Appian’s platform, to give it inside knowledge of Appian’s software. Pegasystems has always denied wrongdoing.
The verdict did not stand. In 2024 the Court of Appeals of Virginia reversed it and ordered a new trial, finding errors including the jury instructions on how damages were caused, and in January 2026 the Supreme Court of Virginia upheld that decision. At the time of writing, the case is back before the Fairfax County Circuit Court for a new trial on both liability and damages, so the allegations remain unproven.
Whatever the final outcome, the case is a useful lens on a dark facet of insider risk: not the accidental sharing of sensitive data, which accounts for most insider incidents, but the deliberate use of someone with legitimate access to obtain proprietary information for another party.
What made the alleged scheme notable was that the person at its centre was not an opportunistic leaker but someone whose trusted access – through a contractor relationship rather than direct employment – was allegedly used as a conduit for information. That is a reminder that “insiders” include contractors, partners and others who are granted access, not just a company’s own staff.
A scheme like this, if it occurs, depends on access that looks legitimate. The person involved can establish trust and credibility, reach high-value information, and work within systems without raising alarms, because their activity resembles ordinary work.
The damage from such an attack extends beyond the immediate financial loss. It compromises client trust, distorts competitive landscapes, and can have lasting repercussions on market positions and business operations. Long-running litigation brings its own cost and uncertainty, whichever side ultimately prevails.
The lesson for organisations is the need for visibility into how sensitive information is accessed and moved – by employees, contractors and partners alike. That means reviewing who can reach proprietary information, applying the principle of least privilege to third-party access, and using insider risk detection that flags unusual activity, like atypical data access or transfer patterns. Regular security awareness training is crucial, equipping people to identify and report anomalies. Establishing a robust security culture with clear reporting channels can turn the workforce into an active defence against internal threats.
Transparent, proportionate controls also act as a deterrent. When people know that access to sensitive information is governed and that unusual data movement is checked, the perceived chance of getting away with misuse falls. This involves knowing where sensitive data sits and who can reach it, conducting regular audits of access to sensitive information, and using behavioural analytics to spot activity that departs from what is normal for a role or account.
Signals worth attention include access to large volumes of data, access to information outside someone’s usual work, data moving to personal accounts or unfamiliar destinations, and attempts to bypass security controls. Physical security matters too, including secure management of facilities so that only authorised personnel access sensitive areas.
No single control guarantees that espionage will be caught, but layered measures reduce the window of opportunity to extract valuable data undetected. This approach guards against both external threats and internal betrayal, helping protect intellectual property and competitive advantage.
Furthermore, the case highlights the importance of a legal framework that deters espionage and offers recourse for affected parties – and of the evidence organisations need to bring to it. It also prompts reflection on competitive practices in the tech industry, where the line between competitive research and misappropriation can be contested. The invaluable lesson for businesses everywhere is the same regardless of how the retrial ends: invest in robust security, including insider risk management, or risk a price that could be much more than monetary.
CEO & Co-Founder, ShadowSight
Who is Christopher McNaughton
Chris is a proficient problem solver with a strategic aptitude for anticipating and addressing potential business issues, particularly in areas such as Insider Threat, Data Governance, Digital Forensics, Workplace Investigations, and Cyber Security. He thrives on turning intricate challenges into opportunities for increased efficiency, offering pragmatic solutions derived from a practical and realistic approach.
Starting his career as a law enforcement Detective, Chris transitioned to multinational organisations where he specialised and excelled in Cyber Security, proving his authority in the field. Even under demanding circumstances, his commitment to delivering exceptional results remains unwavering, underpinned by his extraordinary ability to understand both cyber and business problems swiftly, along with a deep emphasis on active listening.